Packet List Columns

Home > Reference > Packet List Columns

Time and Length

This is the standard time column. It displays the receive time of a packet as local system time, its length in bytes, and if packets were lost, it displays the number of packets that were lost before this packet.

Relative Time

This column displays the relative time of a packet. The relative time is set to zero, when you start data collection of a Packet List view for the first time. You can change the relative time origin via the View > Set Relative Time Origin menu command or by pressing Ctrl+0 on the keyboard. This will set the relative time of the first selected packet in the packet list to zero. Packets that were received before this packet will be displayed with a negative relative time.

You can choose between two different formats: 'Relative Time' displays the time as hours, minutes, seconds, and microseconds; 'Relative Time [s]' displays the time as seconds and microseconds.

Network Device

This column will display the MAC address of the local network card that received a packet. See Address Name Formats for the different format options for the Network Device column.

Note: This column is most useful if you collect packets from multiple network cards and want to use the keyboard navigation feature of the Packet List view (see Analyzing Data). You can also distinguish packets that were received by different network cards based on the color of the time column text (see Packet Source View).

Layer 2 Protocol

This column displays the layer 2 (data-link layer) protocol that was used to encode the packet (e.g. Ethernet II or LLC).

Layer 3 Protocol

This column displays the layer 3 (network layer) protocol that was used to encode the packet (e.g. IPv4 or NetBIOS).

Layer 4 Protocol

This column displays the layer 4 (transport layer) protocol that was used to encode the packet (e.g. UDP, TCP - Data, NetBIOS - Datagram).

Highest Layer Protocol

This column displays the protocol on the highest identified layer that was used to encode the packet. This may be one of the lower layer protocols that is also displayed in the layer 3 or layer 4 columns or an upper layer protocol (e.g. POP3, SMB).

MAC Src.

This column will display the layer 2 MAC address of the system in your LAN that sent a packet. This may be the original sender of the packet or a gateway to another LAN or the internet.

See Address Name Formats for the different format options for the source and destination address columns.

MAC Dest.

This column will display the layer 2 MAC address of the system in your LAN that shall receive a packet. This may be the final destination of the packet or a gateway to another LAN or the internet.

MAC Grp. Src./Dest.

These columns will display the address group to which a MAC address belongs. If no group was selected for an address, the columns display the same as the MAC Src. and MAC Dest. columns (instead of the group base name the address raw name will be used).

Layer 3 Src.

This column will display the layer 3 address of the system that sent a packet. This can be an IPv4, IPv6, IPX, or NSAP address.

Note: Some packets will never be routed outside the LAN and therefore do not have layer 3 addresses (e.g. ARP).

Layer 3 Dest.

This column will display the layer 3 address of the system that shall receive a packet.

Layer 3 Grp. Src./Dest.

These columns will display the address group to which a layer 3 address belongs. If no group was selected for an address, the columns display the same as the Layer 3 Src. and Layer 3 Dest. columns (instead of the group base name the address raw name will be used).

VLAN ID

This column displays the ID or user defined name of the VLAN to which a packet belongs.

VLAN Grp.

This column will display the address group to which a VLAN ID belongs. If no group was selected for a VLAN ID, the column displays the same as the VLAN ID column (instead of the group base name the VLAN ID in raw format will be used).